VV-014highPrompt injection2025-04-01
MCP tool poisoning: hidden instructions in tool descriptions
An MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere.
What it is
Invariant Labs published this as a “Tool Poisoning Attack” against the Model Context Protocol on 1 April 2025. Tool descriptions are passed to the model as trusted context, so text in them acts like instructions.
Their write-up shows a harmless-looking tool whose description tells the agent to read sensitive local files and pass them along as a hidden parameter.
How to check
- List every MCP server configured in your editor or agent, and where each one came from.
- Read the full tool descriptions each server exposes, not the short name your client shows.
How to fix
- Only install MCP servers from sources you trust, and pin versions.
- Keep human approval on for tool calls that read files or reach the network.
Sources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability